This vulnerability in Xerte Online Tools involves improper control over code generation (CWE-94). The antivirus binary path setting can be manipulated to point to a PHP interpreter, which then executes attacker-supplied PHP data uploaded to the server. This leads to remote code execution on the affected system. There is no CVSS score or vendor advisory indicating a fix or mitigation at this time.

Successful exploitation results in remote code execution on the server running Xerte Online Tools, potentially allowing an attacker to execute arbitrary PHP code with the privileges of the application. This can lead to full system compromise depending on the server configuration.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the server settings that control the antivirus binary path and validate or sanitize any configuration inputs to prevent manipulation. Avoid uploading untrusted PHP code or disable PHP execution in upload directories if possible.